The authority had sanctioned AFR Advocates after an incident in 2022 when a member of staff from the firm had hand-delivered a bundle of documents to the home of an individual and, as they were not at home, had left them in the open porch of the person’s property.
It found that AFR’s actions had put the individual’s private and sensitive personal health data at risk.
The law firm appealed the breach determination to the Royal Court but lost last December.
However, as both sides announced the consensual resolution of the matter yesterday, highlighting the cost of proceedings, the law firm reinforced its view, which it said was upheld by the court, that the documents were no longer considered confidential as they were part of a publicly-available bundle of documents before the court.
The ODPA welcomed AFR’s commitment to enhancing its own internal safeguards in relation to data protection.
‘We are pleased to reach a consensual resolution with AFR and are encouraged by their commitment to elevate safeguards for sensitive documents,’ said commissioner Brent Homan.
‘We appreciate the example set and invite other organisations responsible for the care of sensitive information to reflect on their document handling procedures to ensure their proper protection.’
He said that, supplemented by mandatory training, AFR will be implementing a policy governing the handling and delivery of physical records containing personal data, including medical information. This policy will require reasonable steps to be taken to ensure a level of security appropriate to the personal data, including requiring secure delivery arrangements.
The law firm’s appeal was the first against a breach determination issued by the authority, which included a reprimand.
The ODPA said at the time of the judgment that there were important lessons to be taken from the court’s determination, particularly in relation to safeguarding special category data, such as health data.
You need to be logged in to comment.